cursor-hook-authoring
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill describes procedures for installing scripts into the .git/hooks directory or a Cursor-managed hooks path. Git hooks are automatically triggered by version control actions, establishing a persistent mechanism for code execution within the repository context.
- [DYNAMIC_EXECUTION]: The instructions direct the agent to generate a bash script (.cursor/hooks/strip-co-authored-by.sh) and an installation script (scripts/install-cursor-agent-hooks.sh), granting them execution permissions and running them locally.
- [COMMAND_EXECUTION]: The skill requires the use of shell commands such as chmod, readlink, and direct script invocation to manage the hook lifecycle and verify functionality.
- [INDIRECT_PROMPT_INJECTION]: \n- Ingestion points: The hook script ingests the content of Git commit message files (COMMIT_MSG_FILE) for processing.\n- Boundary markers: None are defined to differentiate between valid commit text and potential instructions.\n- Capability inventory: The script uses awk for text filtering and mv for file system modification.\n- Sanitization: No escaping or sanitization is performed on the ingested commit message data.
Audit Metadata